SMERC | Microsoft-Style Replay

Replay security events before response automation acts

SMERC can take Microsoft Sentinel, Defender, Azure Activity, and advanced-hunting style event metadata, map it to a proposed response action, and score whether that action should be allowed, throttled, frozen, denied, or escalated before execution.

1 ALLOW 5 THROTTLE 0 FREEZE 0 DENY
Replay summary CISO review GitHub repo

Replay Result

SMERC changes the posture of response automation

The current synthetic Microsoft-style replay includes 6 events across Defender-style alerts, Sentinel-style incidents, Azure Activity events, and advanced-hunting-style records. SMERC produced a different runtime posture from the Microsoft-style workflow outcome in 5 of 6 sample events.

6Microsoft-style events replayed
83.3%Decision difference rate
2Auto responses restrained
3Review/escalation events with bounded path

What This Tests

Not detection quality, but response recoverability

Microsoft security tools are strong at detection, identity, telemetry, workflow, and response execution. SMERC tests a different runtime question: if the proposed response is wrong or too broad, can the organization contain, reverse, explain, and learn from it?

Alert or incident Proposed response SMERC scoring SPARTa posture Replay evidence

Example Difference

Auto-isolate becomes constrained execution

A Microsoft Defender-style high-severity lateral-movement alert may trigger automatic endpoint isolation. SMERC does not reject the need to respond. It returns `THROTTLE` when the response has business side effects and needs scope limits, rollback planning, replay evidence, and rate-limited execution.

Review replay summary External benchmark replay Inspect repository

Pilot Path

Shadow mode, metadata only

A security team could export event metadata, map each event to a proposed response action, and compare existing workflow outcomes with SMERC posture. The value to test is whether SMERC can reduce risky automated response blast radius without forcing teams back to blunt allow/block decisions. The first test does not require production blocking, private telemetry in the public repo, or replacement of Microsoft security tools.

  • Start with 25 to 100 historical alert or incident records.
  • Remove secrets, customer data, prompts, and regulated content.
  • Map each record to the proposed response action and recoverability signals.
  • Compare reviewer agreement, false release risk, false constraint rate, and latency.

Evidence Boundary

Current status

This replay uses synthetic Microsoft-style event shapes. It is not Microsoft telemetry, Microsoft certification, Sentinel validation, Defender validation, customer validation, threat detection, incident-reduction proof, or a replacement for Microsoft security tooling.